Level 3 Head: The top entity in a Level 3 group, as determined by APRA under Prudential Standard 3PS 001. It is the entity on which the obligations in this standard fall. It must appoint the Appointed Auditor, ensure compliance with the prudential framework, and provide access to data, staff, and the board.

Appointed Auditor: The single auditor appointed for the Level 3 group under this standard. That auditor may be the same person or firm already auditing the Level 3 Head for Corporations Act purposes. APRA can require a separate or additional auditor. The auditor must be a fit and proper person under CPS 520 Fit and Proper, satisfy independence requirements in CPS 510 Governance, and not be subject to a direction or order under the Prudential Acts.

Reasonable assurance: A high level of assurance, but not absolute, that the subject matter is free from material misstatement. This is the level required for APRA data collections sourced only from accounting records. The standard adopts the AUASB definition from the Framework for Assurance Engagements.

Limited assurance: A lower level of assurance than reasonable assurance, expressed as a negative form of conclusion (e.g., nothing has come to the auditor’s attention to suggest material misstatement). This applies to data from non‑accounting records, internal controls on design and operating effectiveness, and the final compliance opinion.

APRA data collections: All data collected by APRA under the Financial Sector (Collection of Data) Act 2001. The standard distinguishes between data sourced from accounting records only, from non‑accounting records only, and from a combination. The required level of assurance varies accordingly.

Prudential requirements: The full suite of obligations imposed by the Prudential Acts (Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995), regulations, prudential standards, reporting standards, conditions on authority, and any other requirements APRA imposes in relation to the Level 3 Head.

Special purpose engagement: An ad‑hoc audit engagement that APRA can demand on any aspect of the group’s operations, prudential reporting, risk management systems or financial position. APRA may require this without prior consultation, although it normally consults. The engagement must produce a report within three months of the commissioning notice, unless APRA extends or shortens that period.

The standard directly imposes duties on three categories of entities. First, the Level 3 Head is the primary duty‑bearer. It must appoint the Appointed Auditor, negotiate a legally binding contract containing the required terms, use all reasonable endeavours to ensure the auditor complies, and bear all costs. It must provide the auditor with full access to data, information, reports, staff, the board and the board audit committee of the Level 3 Head, and the auditors of all Level 3 institutions within the group. It must also inform the auditor of all prudential requirements and provide any other information APRA has given the Head that may assist the auditor. When APRA requests, the Level 3 Head must produce the auditor’s terms of engagement, instructions, correspondence, and management letters. The board or board audit committee must receive all reports, APRA responses, and any commentary exchanged between the Head and APRA.

Second, the Appointed Auditor has direct obligations to APRA, including submitting reports and assessments directly, attending all meetings with APRA, supplying information and documents APRA requests, and preparing reports on the basis that APRA may rely on them. The auditor must not place sole reliance on APRA’s own work. The auditor has an exceptional duty to withhold reports from the Level 3 Head if disclosure would jeopardise depositor, policyholder or RSE beneficiary interests, or if a situation of mistrust exists with the board or senior management. This creates a direct reporting line to the regulator that bypasses the client entity, which is unusual in normal corporate auditing.

Third, APRA itself is affected as the principal recipient and user of the audit products. APRA may adjust or exclude specific requirements for a Level 3 Head, require additional auditors, direct the use of alternative auditing standards, and commission special purpose engagements. APRA’s liaison with the auditor will normally be trilateral (APRA, Level 3 Head, auditor), but bilateral meetings can occur at any time at the request of either APRA or the auditor. Persons providing information to APRA, including officers and employees of the Level 3 group, are indirectly affected by the criminal offence provisions for providing false or misleading information.

Duty to appoint an auditor: The Level 3 Head must appoint an Appointed Auditor. The auditor may be the same person as the Corporations Act auditor. APRA can compel the appointment of an additional auditor.

Duty to contract: The terms of engagement must be set out in a legally binding contract. That contract must require the auditor to fulfil the roles and responsibilities in the standard, and to comply with Australian Auditing Standards unless they conflict with the standard, in which case the standard prevails. The Head must use all reasonable endeavours to secure the auditor’s compliance.

Duty to provide access: The Head must give the auditor access to all data, information, reports, staff, the board and board audit committee, and the auditors of Level 3 institutions, as the auditor reasonably believes necessary. The Head must also inform the auditor of all prudential requirements and share any APRA information that might assist the auditor.

Duty to bear costs: All costs of preparing and submitting reports, documents and other material under the standard, whether routine or special purpose, must be paid by the Level 3 Head. This includes the costs of any additional auditor APRA requires.

Duty to submit reports to APRA: The Appointed Auditor must submit all reports directly to APRA, not through the Level 3 Head, unless APRA permits otherwise. Reports must be prepared on the basis that APRA may rely on them. The auditor must also supply all information and documents APRA requests.

Duty to attend meetings: The Appointed Auditor must attend all meetings with APRA related to the standard, whether bilateral, trilateral, or on any other basis APRA specifies (unless APRA says otherwise). Attendance cannot be delegated to the Head’s management.

Right to withhold reports: The Appointed Auditor has a duty to refrain from notifying or providing the Level 3 Head with reports if the auditor considers that doing so would jeopardise the interests of depositors, policyholders or RSE beneficiaries, or if a situation of mistrust exists between the auditor and the board or senior management. This is a significant departure from the normal auditor‑client relationship.

Duty of internal audit: The Level 3 Head must ensure its internal audit reviews the policies, processes and controls for compliance with APRA’s prudential requirements. Internal auditors must be allowed representation in meetings with APRA, the Head, and the Appointed Auditor.

The prudential standard itself does not create pecuniary penalties. Enforcement occurs through the underlying Prudential Acts and through the general criminal law. Paragraph 12 of the standard explicitly warns that providing false or misleading information to APRA, whether directly or indirectly, is an offence under sections 137.1 and 137.2 of the Criminal Code 1995. Those sections carry maximum penalties of 12 months imprisonment for simple offences and up to five years for aggravated offences (for example, where the information is misleading in a material particular and the person knows it is false). This applies not just to the Appointed Auditor, but to officers and employees of the Level 3 Head and Level 3 institutions who are involved in supplying information.

APRA has a range of enforcement powers under the Banking Act, Insurance Act, and Life Insurance Act. Under section 11AF of the Banking Act, for example, APRA can give directions to an ADI to take specified action if it is necessary in the interests of depositors. Non‑compliance with a prudential standard can form the basis for a direction. The standard itself gives APRA the power to adjust or exclude specific requirements for a Level 3 Head (paragraph 32), thus APRA can tailor the obligation. APRA can also require the appointment of an additional auditor, which imposes further cost on the Level 3 Head as a remedial measure.

The standard creates an additional enforcement avenue through the Appointed Auditor’s direct reporting line to APRA. If the auditor forms the view that the Level 3 Head is not complying, the auditor must report that fact directly, and may do so without notifying the Head if the circumstances in paragraph 23 apply. This reduces the risk of information being blocked or filtered by management.

The failure to appoint an auditor, or to ensure the auditor is fit and proper, could lead APRA to exercise its direction power or vary the Level 3 Head’s authority. While the standard does not prescribe a specific civil penalty, the consequences of breach include increased regulatory scrutiny, reputational damage, and possible restrictions on the group’s activities.

The standard operates within a complex web of overlapping regulatory instruments. Paragraph 1 recites its making under three Acts: the Banking Act 1959, the Insurance Act 1973, and the Life Insurance Act 1995. It applies only to Level 3 Heads, which are defined in Prudential Standard 3PS 001. It interacts with the Corporations Act 2001 in allowing the Appointed Auditor to be the same auditor who audits the Level 3 Head for Corporations Act purposes, but the obligations under this standard are separate and additional.

The standard explicitly overrides Australian Auditing Standards and Guidance issued by the AUASB where they are inconsistent (paragraph 8(b)(i)). This means that an auditor cannot rely on auditing standards to justify a different approach. Where the standard requires reasonable assurance for accounting‑sourced data and limited assurance for non‑accounting data, the auditor must apply those concepts as defined in the AUASB Framework for Assurance Engagements, but the standard dictates the subject matter and the level.

The standard also interacts with the Financial Sector (Collection of Data) Act 2001. The routine reports on APRA data collections are specifically tied to data collected under FSCODA. The reporting standards made under FSCODA are part of the prudential requirements the auditor must assess.

Other prudential standards are incorporated by reference: CPS 520 Fit and Proper (for the Appointed Auditor’s fitness), CPS 510 Governance (for independence), and any other standards containing prudential requirements. The internal audit requirement in paragraphs 18-19 also references the broader prudential framework. The standard does not replace those standards but adds audit and assurance obligations on top.

The Criminal Code 1995 is the enforcement backdrop for false or misleading information. The standard does not create new offences but warns of existing ones.

Adjustments and exclusions (paragraph 32) allow APRA to vary the application of the standard to a particular Level 3 Head, which could reduce or increase its interaction with other laws.

The text of the standard as provided shows a commencement date of 1 July 2017 (paragraph 4). No amendment history is included in the source. The standard was likely issued as a new instrument on that date, replacing or superseding any earlier group audit requirements that APRA may have imposed through individual directions or earlier prudential standards. Because the source does not recite any amending instruments, it is not possible to detail specific amendments. Any amendments that have occurred since 1 July 2017 would need to be identified from the Federal Register of Legislation or APRA’s website. The standard is part of APRA’s broader prudential framework, which is periodically updated; for example, CPS 520 and CPS 510 have been amended since 2017. However, 3PS 003 itself may not have been amended. Practitioners relying on the standard should check the current version on the APRA website for any updated text or transitional provisions. The standard has a five‑year review cycle common to APRA’s prudential standards.

The source text contains no references to any litigation concerning this prudential standard. APRA’s prudential standards are legislative instruments and are rarely litigated directly; challenges typically arise in the context of a broader regulatory action or judicial review of an APRA decision. As at the date of the text, there are no cited cases that interpret 3PS 003. That is not surprising: the standard is highly prescriptive and its obligations are largely administrative and procedural. Disputes might arise over the scope of an auditor’s duty to withhold reports under paragraph 23, or over whether a Level 3 Head has used “all reasonable endeavours” to secure the auditor’s compliance. The standard also sits within a regulatory environment where auditors may face professional negligence claims if they fail to comply with their obligations, but such claims would be determined under general law, not under the standard itself. The lack of litigation suggests that the standard has been complied with or that disputes are resolved administratively.

A Level 3 Head may assume that the standard’s audit requirements are essentially the same as those for the entity’s Corporations Act audit. That assumption is dangerous. The standard imposes additional layers: separate assurance on APRA data collections, separate assurance on internal controls over prudential compliance, and a separate compliance opinion. These may require different testing, different sample sizes, and different deadlines.

The Level 3 Head bears all costs, but also bears the cost of any additional auditor APRA requires. APRA may decide the additional auditor should be a different firm, which could create coordination and confidentiality challenges.

The Appointed Auditor may be required to withhold reports from the Level 3 Head if disclosure would jeopardise depositors, policyholders or beneficiaries, or if a situation of mistrust exists. This is a significant departure from normal client‑auditor relationships. The Level 3 Head may not even know that the auditor has submitted a damaging report directly to APRA. The board may be unaware of a situation of mistrust until APRA acts.

The auditor must submit reports within three months of the Level 3 Head’s financial year end, but special purpose reports are due within three months of the commissioning notice. If APRA commissions a special purpose engagement that requires significant additional work, the three‑month deadline may be unrealistic. The standard does not provide for extensions except by APRA’s own determination.

The standard overrides Australian Auditing Standards where they are inconsistent. An auditor who follows Auditing Standards blindly may breach the standard. For example, Auditing Standards require the auditor to communicate with those charged with governance, but paragraph 23 may require the auditor to withhold that communication.

The requirement for the Level 3 Head to “use all reasonable endeavours” to ensure the auditor complies is an obligation of conduct, not of result. It is not a guarantee, but it imposes a due diligence burden on the Head to monitor the auditor’s compliance.

The Level 3 Head must provide the auditor with all APRA information that may assist the auditor. This includes correspondence that might be adverse to the Head’s interests. Withholding such information could be a breach.

The Level 3 Head’s first practical step is to identify whether it is in fact a Level 3 Head under Prudential Standard 3PS 001. If so, it must appoint an Appointed Auditor for the group. That appointment should be documented in a legally binding contract that explicitly incorporates the requirements of paragraphs 7 to 12 of the standard. The contract must require the auditor to comply with the standard and with AUASB standards except where the standard prevails. It should also require the auditor to comply with any alternative standards APRA may later specify. The Level 3 Head should negotiate a clause that allocates costs (all borne by the Head) and provides for access.

The Level 3 Head must verify that the Appointed Auditor is a fit and proper person under CPS 520 and independent under CPS 510. This involves obtaining a declaration from the auditor or its firm, checking for any directions or orders under the Prudential Acts, and ensuring that the appointment is approved by the board or a committee.

The Level 3 Head must provide the auditor with a comprehensive briefing on all prudential requirements applicable to the group, including any conditions on authority, reporting standards, and any APRA correspondence. The Head should maintain a register of all prudential requirements and share it with the auditor annually.

The Head must ensure that the auditor has full access to data, reports, staff, and the board. The Head should arrange for the board and board audit committee to meet with the auditor as needed, and for the auditor to have direct contact with auditors of Level 3 institutions in the group.

The internal audit function must be aligned. The scope of internal audit must include a review of the policies, processes and controls for prudential compliance. Internal auditors should be allowed to attend meetings with APRA and the external auditor. The Head should coordinate the internal audit plan with the external Appointed Auditor to avoid duplication.

The Head must ensure that the auditor’s routine reports are produced within three months of year end and submitted directly to APRA. The Head should have a process to receive the same reports simultaneously, unless the auditor invokes paragraph 23. If the auditor does withhold reports, the Head should investigate the reasons and, if appropriate, engage with APRA.

For special purpose engagements, the Head must respond promptly to APRA’s demand, appoint the auditor (or accept APRA’s appointment), and ensure the auditor has access and information to meet the three‑month deadline.

The Head should keep a complete file of all terms of engagement, instructions, correspondence, management letters, and APRA responses, and be prepared to provide them to APRA on request.

Finally, the board must receive all audit reports, APRA responses, and any commentary exchanged between the Head and APRA on those reports. The board should also receive a summary of the standard’s requirements and confirm that the Head is meeting its obligations.